<!DOCTYPE HTML>
<html>
<!-- SECTION: Man Pages -->
<head>
	<link rel="stylesheet" type="text/css" href="../cups-printable.css">
	<title>cupsd-logs(5)</title>
</head>
<body>
<h1 class="title">cupsd-logs(5)</h1>
<h2 class="title"><a name="NAME">Name</a></h2>
cupsd-logs - cupsd log files (access_log, error_log, and page_log)
<h2 class="title"><a name="DESCRIPTION">Description</a></h2>
<b>cupsd</b>(8)
normally maintains three log files: <i>access_log</i> to track requests that are submitted to the scheduler, <i>error_log</i> to track progress and errors, and <i>page_log</i> to track pages that are printed.
Configuration directives in
<b>cupsd.conf</b>(5)
and
<b>cups-files.conf</b>(5)
control what information is logged and where it is stored.
<h3><a name="ACCESS_LOG_FILE_FORMAT">Access Log File Format</a></h3>
The <i>access_log</i> file lists each HTTP resource that is accessed by a web browser or client.
Each line is in an extended version of the so-called "Common Log Format" used by many web servers and web reporting tools:
<pre class="man">

    <i>host group user date-time </i>"<i>method resource version</i>" <i>status bytes
      ipp-operation ipp-status</i>

</pre>
For example:
<pre class="man">

    10.0.1.2 - - [01/Dec/2005:21:50:28 +0000] "POST / HTTP/1.1" 200 317
      CUPS-Get-Printers successful-ok-ignored-or-substituted-attributes
    localhost - - [01/Dec/2005:21:50:32 +0000] "GET /admin HTTP/1.1"
      200 0 - -
    localhost - - [01/Dec/2005:21:50:32 +0000] "POST / HTTP/1.1"
      200 157 CUPS-Get-Printers
      successful-ok-ignored-or-substituted-attributes
    localhost - - [01/Dec/2005:21:50:32 +0000] "POST / HTTP/1.1"
      200 1411 CUPS-Get-Devices -
    localhost - - [01/Dec/2005:21:50:32 +0000] "GET /admin HTTP/1.1"
      200 6667 - -

</pre>
The <i>host</i> field will normally only be an IP address unless you have enabled the HostNameLookups directive in the <i>cupsd.conf</i> file or if the IP address corresponds to your local machine.
<p>The <i>group</i> field always contains "-".
<p>The <i>user</i> field is the authenticated username of the requesting user.
If no username and password is supplied for the request then this field contains "-".
<p>The <i>date-time</i> field is the date and time of the request in local time and is in the format "[DD/MON/YYYY:HH:MM:SS +ZZZZ]".
<p>The <i>method</i> field is the HTTP method used: "GET", "HEAD", "OPTIONS", "POST", or "PUT".
"GET" requests are used to get files from the server, both for the web interface and to get configuration and log files.
"HEAD" requests are used to get information about a resource prior to a "GET".
"OPTIONS" requests are used to upgrade connections to TLS encryption.
"POST" requests are used for web interface forms and IPP requests.
"PUT" requests are used to upload configuration files.
<p>The <i>resource</i> field is the filename of the requested resource.
<p>The <i>version</i> field is the HTTP specification version used by the client.
For CUPS clients this will always be "HTTP/1.1".
<p>The <i>status</i> field contains the HTTP result status of the request, as follows:
<div style="margin-left: 5.0em;">
<dl class="man">
<dt>200
<dd style="margin-left: 5.0em">Successful operation.
<dt>201
<dd style="margin-left: 5.0em">File created/modified successfully.
<dt>304
<dd style="margin-left: 5.0em">The requested file has not changed.
<dt>400
<dd style="margin-left: 5.0em">Bad HTTP request; typically this means that you have a malicious program trying to access your server.
<dt>401
<dd style="margin-left: 5.0em">Unauthorized, authentication (username + password) is required.
<dt>403
<dd style="margin-left: 5.0em">Access is forbidden; typically this means that a client tried to access a file or resource they do not have permission to access.
<dt>404
<dd style="margin-left: 5.0em">The file or resource does not exist.
<dt>405
<dd style="margin-left: 5.0em">URL access method is not allowed; typically this means you have a web browser using your server as a proxy.
<dt>413
<dd style="margin-left: 5.0em">Request too large; typically this means that a client tried to print a file larger than the MaxRequestSize allows.
<dt>426
<dd style="margin-left: 5.0em">Upgrading to TLS-encrypted connection.
<dt>500
<dd style="margin-left: 5.0em">Server error; typically this happens when the server is unable to open/create a file - consult the error_log file for details.
<dt>501
<dd style="margin-left: 5.0em">The client requested encryption but encryption support is not enabled/compiled in.
<dt>505
<dd style="margin-left: 5.0em">HTTP version number not supported; typically this means that you have a malicious program trying to access your server.
</div>
</dl>
<p>The <i>bytes</i> field contains the number of bytes in the request.
For POST requests the bytes field contains the number of bytes of non-IPP data that is received from the client.
<p>The <i>ipp-operation</i> field contains either "-" for non-IPP requests or the IPP operation name for POST requests containing an IPP request.
<p>The <i>ipp-status</i> field contains either "-" for non-IPP requests or the IPP status code name for POST requests containing an IPP response.
<h3><a name="ERROR_LOG_FILE_FORMAT">Error Log File Format</a></h3>
The <i>error_log</i> file lists messages from the scheduler - errors, warnings, etc. The LogLevel directive in the
<b>cupsd.conf</b>(5)
file controls which messages are logged:
<pre class="man">

    level date-time message

</pre>
For example:
<pre class="man">

    I [20/May/1999:19:18:28 +0000] [Job 1] Queued on 'DeskJet' by 'mike'.
    D [20/May/1999:19:18:28 +0000] [Job 1] argv[0]="DeskJet"
    D [20/May/1999:19:18:28 +0000] [Job 1] argv[1]="1"
    D [20/May/1999:19:18:28 +0000] [Job 1] argv[2]="mike"
    D [20/May/1999:19:18:28 +0000] [Job 1] argv[3]="myjob"
    D [20/May/1999:19:18:28 +0000] [Job 1] argv[4]="1"
    D [20/May/1999:19:18:28 +0000] [Job 1] argv[5]="media=
      na_letter_8.5x11in sides=one-sided"
    D [20/May/1999:19:18:28 +0000] [Job 1] argv[6]="/var/spool/cups/
      d000001-001"
    I [20/May/1999:19:21:02 +0000] [Job 2] Queued on 'DeskJet' by 'mike'.
    I [20/May/1999:19:22:24 +0000] [Job 2] Canceled by 'mike'.

</pre>
The <i>level</i> field contains the type of message:
<dl class="man">
<dt>A
<dd style="margin-left: 5.0em">Alert message (LogLevel alert)
<dt>C
<dd style="margin-left: 5.0em">Critical error message (LogLevel crit)
<dt>D
<dd style="margin-left: 5.0em">Debugging message (LogLevel debug)
<dt>d
<dd style="margin-left: 5.0em">Detailed debugging message (LogLevel debug2)
<dt>E
<dd style="margin-left: 5.0em">Normal error message (LogLevel error)
<dt>I
<dd style="margin-left: 5.0em">Informational message (LogLevel info)
<dt>N
<dd style="margin-left: 5.0em">Notice message (LogLevel notice)
<dt>W
<dd style="margin-left: 5.0em">Warning message (LogLevel warn)
<dt>X
<dd style="margin-left: 5.0em">Emergency error message (LogLevel emerg)
</dl>
<p>The <i>date-time</i> field contains the date and time of when the page started printing. The format of this field is identical to the data-time field in the <i>access_log</i> file.
<p>The <i>message</i> field contains a free-form textual message.
Messages from job filters are prefixed with "[Job NNN]" where "NNN" is the job ID.
<h3><a name="PAGE_LOG_FILE_FORMAT">Page Log File Format</a></h3>
The <i>page_log</i> file lists the total number of pages (sheets) that are printed.
By default, each line contains the following information:
<pre class="man">

    <i>printer user job-id date-time </i><b>total </b><i>num-sheets job-billing
      job-originating-host-name job-name media sides</i>

</pre>
For example the entry for a two page job called "myjob" might look like:
<pre class="man">

    DeskJet root 1 [20/May/1999:19:21:06 +0000] total 2 acme-123
      localhost myjob na_letter_8.5x11in one-sided

</pre>
The PageLogFormat directive in the
<b>cupsd.conf</b>(5)
file can be used to change this information.
<p>The <i>printer</i> field contains the name of the printer that printed the page.
If you send a job to a printer class, this field will contain the name of the printer that was assigned the job.
<p>The <i>user</i> field contains the name of the user (the IPP requesting-user-name attribute) that submitted this file for printing.
<p>The <i>job-id</i> field contains the job number of the page being printed.
<p>The <i>date-time</i> field contains the date and time of when the page started printing.
The format of this field is identical to the data-time field in the <i>access_log</i> file.
<p>The <i>num-sheets</i> field provides the total number of pages (sheets) that have been printed on for the job.
<p>The <i>job-billing</i> field contains a copy of the job-billing or job-account-id attributes provided with the IPP Create-Job or Print-Job requests or "-" if neither was provided.
<p>The <i>job-originating-host-name</i> field contains the hostname or IP address of the client that printed the job.
<p>The <i>job-name</i> field contains a copy of the job-name attribute provided with the IPP Create-Job or Print-Job requests or "-" if none was provided.
<p>The <i>media</i> field contains a copy of the media or media-col/media-size attribute provided with the IPP Create-Job or Print-Job requests or "-" if none was provided.
<p>The <i>sides</i> field contains a copy of the sides attribute provided with the IPP Create-Job or Print-Job requests or "-" if none was provided.
<h2 class="title"><a name="SEE_ALSO">See Also</a></h2>
<b>cupsd</b>(8),
<b>cupsd.conf</b>(5),
<b>cups-files.conf</b>(5),
CUPS Online Help (<a href="http://localhost:631/help">http://localhost:631/help</a>)
<h2 class="title"><a name="COPYRIGHT">Copyright</a></h2>
Copyright &copy; 2007-2019 by Apple Inc.

</body>
</html>
